Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Outbound Network Connection from Java Using Default Ports

The following analytic detects outbound network connections from Java processes to default ports used by LDAP and RMI protocols, which may indicate exploitation of the CVE-2021-44228-Log4j vulnerability. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs. Monitoring this activity is crucial as it can signify an attacker's attempt to perform JNDI lookups and retrieve malicious payloads. If confirmed malicious, this activity could lead to remote code execution and further compromise of the affected server.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: sysmon_eventid_1_and_sysmon_eventid_3

What the source says

What fires this without an attack behind it

Legitimate Java applications may use perform outbound connections to these ports. Filter as needed

References

Tagged by the source as

Log4Shell CVE-2021-44228EndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.